Harden REST API authentication, thread safety and lifecycle

[SrBedrock]

Closes #1

• Require exact tokens on both player and server endpoints; reject invalid token configurations and remove secret logging.
• Serialize responses with Gson while retaining the existing string status and message fields.
• Run Bukkit and PlaceholderAPI lookups on the main thread with a timeout, per-peer rate limit, and concurrency cap.
• Distinguish unknown placeholders from valid empty results.
• Stop the HTTP listener on disable; reload and validate configuration, switch listener, and roll back after bind failures.
• Configure bind and peer IP allowlist, document Docker/Pterodactyl plus HTTPS proxy setup, and add regression tests and a CI workflow.
• Remove a machine-specific Windows org.gradle.java.home setting so builds use the selected JDK.

Build update: Java 25 toolchain and CI, Paper API 1.21.11, Gradle wrapper 9.8.0, Shadow 9.6.1 and PlaceholderAPI 2.12.3. Updated JUnit launcher and Mockito for Java 25.

Validation: GitHub Actions Build run Fredthedoggy#6 passed bash gradlew test shadowJar --no-daemon on JDK 25.

[SrBedrock]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 22ae2c24b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".